xfrm: Add dir validation to "in" data path lookup
authorAntony Antony <antony.antony@secunet.com>
Tue, 30 Apr 2024 07:09:29 +0000 (09:09 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Wed, 1 May 2024 08:06:27 +0000 (10:06 +0200)
commit304b44f0d5a4c2f91f82f7c31538d00485fb484c
treecf8a804020173cc515fe9d0f78ef419ee703f2fc
parent601a0867f86cbb5e137ce485a7eb60cbf9fc5180
xfrm: Add dir validation to "in" data path lookup

Introduces validation for the x->dir attribute within the XFRM input
data lookup path. If the configured direction does not match the
expected direction, input, increment the XfrmInStateDirError counter
and drop the packet to ensure data integrity and correct flow handling.

grep -vw 0 /proc/net/xfrm_stat
XfrmInStateDirError      1

Signed-off-by: Antony Antony <antony.antony@secunet.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Documentation/networking/xfrm_proc.rst
include/uapi/linux/snmp.h
net/ipv6/xfrm6_input.c
net/xfrm/xfrm_input.c
net/xfrm/xfrm_proc.c